I would expect it to be part of the system updater, now you have disabled that service there should be no more instances of it running. There was no indication of malware in your logs